What’s Vulnerable › Vulnerabilities

CVE-2024-6302: Improper Handling of Insufficient Permissions or Privileges in Conduit

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-25 · updated 2026-06-17
• Weakness: CWE-280

Description

Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local user to redact any message from users on the same server, given that they are able to send redaction events.

Affected products

• The Conduit Contributors Conduit: before 0.7.0 — fixed in 0.7.0

How to fix

Upgrade to a fixed version: The Conduit Contributors Conduit 0.7.0. Check the vendor advisory for mitigations.

References

• https://conduit.rs/changelog/#v0-7-0-2024-04-25
• https://gitlab.com/famedly/conduit/-/releases/v0.7.0
• https://conduit.rs/changelog/#v0-7-0-2024-04-25
• https://gitlab.com/famedly/conduit/-/releases/v0.7.0

Get alerted when CVE-2024-6302 or the next vulnerability affects your stack